Spotting Lookalike and Fake Web Addresses

Fake sites rarely look fake. They borrow logos and layouts, so the address is often the only honest clue. Here is how to read it.

Read the address from the right

The part of a web address that decides who controls the site is the registered domain, just before the first single slash. Everything to its left can be chosen freely by whoever owns that domain.

Illustration only; the address above is made up.

Here the site belongs to whoever owns example-login.net. The words "yourbank" at the front are decoration. Reading from the right, then stopping at the domain, is the single most useful habit for avoiding fake pages.

Common tricks

• Typos on purpose. Typosquatting relies on people mistyping a popular address, so the impostor registers the misspelling: a doubled letter, a swapped pair or a missing dot.
• Lookalike characters. An IDN homograph attack uses characters from other alphabets that look the same as Latin letters, so two addresses can appear identical on screen while being different domains.
• Different ending. The same name with a different top-level domain, such as .net instead of .com, can belong to someone else entirely.
• Extra words. Additions like "-secure", "-support", "-login" or "-app" make a domain feel trustworthy without making it so.
• Several "real" sites. Some services operate many mirror domains. When many addresses all claim to be the genuine one, verify each against a source you already trust.

What the padlock does not tell you

The padlock means the connection to the site is encrypted. It does not mean the site is honest. Fake sites can and do use encrypted connections.

Habits that work

1. For sites that matter, such as your bank or email, use a bookmark you created yourself, and use only that.
2. Do not log in from a link in an email or message; open the site your usual way instead.
3. Let your password manager fill passwords. Most will refuse to fill on a domain that does not match the one saved.
4. If an address looks odd, copy it into a plain text editor, where unusual characters are easier to see.

When you are unsure

Close the page. There is almost never a genuine reason you must act through a link in the next few minutes. Pressure to hurry is itself one of the classic signs of phishing.

Last checked 2026-11-09